Your company's data, your buyers' data, and how we treat both

PropDrop ("PropDrop", "we", "us") is a software service for real-estate companies: brokerages, developers' sales teams and independent brokers. It includes the company dashboard and CRM, the AI sales agent, the website chat widget, each company's public page, and the channels a company connects: WhatsApp, Messenger, Instagram and Telegram (together, the "Service").

This policy applies to the people who use the Service for a company (owners, managers and sales agents), to visitors of our website, and, in the limited way described in section 2, to the buyers, tenants and property owners who contact a company through the Service.

Data protection law separates the party that decides how personal data is used (the controller) from the party that processes it on someone else's behalf (the processor). Which one we are depends on the data:

Company account data

Names, emails, phone numbers and roles of the people who sign up and work in the dashboard, plus billing details. PropDrop is the controller and this policy applies directly.

Client data

Conversations, contact details, property requests, viewings, deals and payment records of the buyers, tenants and owners a company deals with. The company is the controller and PropDrop is the processor. We use this data only to provide the Service to that company, following its settings and instructions.

Aggregated data

Statistics that don't identify any person or company, such as total message volume across the platform. We use it to run and improve the Service.

If you're a buyer, tenant or owner who contacted a company, that company's own privacy notice applies first. See section 13.

Some of what your team stores is for your company's eyes only. PropDrop keeps it out of anything a buyer can see:

• Owner contacts, commission percentages and amounts, deal values and expenses are never shown on your public page and are never given to the AI agent to quote to clients.
• Private selling notes you write for the AI help it pitch a unit, but the agent is instructed never to reveal them, and they never appear publicly.
• Inside your team, access follows roles: deals and commissions are visible to the owner and managers, and sales agents see only qualified leads and contacts.

• To provide the Service: receive and route messages, write AI replies from your catalog, qualify leads, record viewing requests, notify your team and show everything in your dashboard.
• To manage accounts, roles, billing requests, AI conversation quotas and plan limits.
• To keep the Service secure: detect abuse, prevent fraud, verify webhooks and investigate incidents.
• To support you when you contact us, and to send service messages such as invitations, quota warnings and billing notices.
• To understand how the product is used, in aggregate, so we can fix problems and improve it.
• To comply with legal obligations and enforce our Terms of service.

To write a reply, the AI agent needs context. When a client messages your company, we send the recent part of the conversation, the matching units and projects from your catalog, your FAQs and your agent instructions to a large language model through OpenRouter, a service that routes each request to an AI model provider. If the main model is unavailable, OpenRouter automatically falls back to another model we've configured.

• We send only what's needed to produce the reply and qualify the request.
• PropDrop doesn't train or fine-tune AI models on your conversations, catalog or client data.
• The agent answers only from your own catalog, FAQs and instructions, but AI can still make mistakes. Your team sees every conversation and can take over at any time.
• When the agent takes a viewing request, it records the client's preferred day, time and place as a request for your team. It never confirms a slot itself.

Where the law requires a legal basis, we rely on:

• Contract: to provide the Service your company signed up for.
• Legitimate interests: to secure, maintain and improve the Service, as long as those interests aren't overridden by your rights.
• Legal obligation: to keep financial records and respond to lawful requests.
• Consent: where we ask for it, for example browser notifications. You can withdraw it at any time.

For client data, the company is responsible for having its own legal basis for collecting it and for telling its clients how it's used.

We share data only with the providers that help us run the Service, and only for that purpose:

Our providers may store or process data outside your country. When data leaves Egypt or the Gulf country you work in, we rely on providers with strong security commitments and on the safeguards the applicable law requires, such as contractual protections.

• While your account is active: we keep your data for as long as you use the Service. Your team can delete conversations, contacts, listings and other records from the dashboard at any time.
• After you close your account: we delete your company's data within 30 days. Copies in backups are removed within 90 days as the backups rotate.
• Billing records: kept as long as accounting law requires.
• Security logs and raw channel events: kept for a limited period, then deleted or anonymised.

• Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest by our hosting provider.
• Channel tokens and app secrets encrypted with AES-256-GCM before they're stored, in a table only our servers can read.
• Every incoming Meta webhook is checked against your app secret's signature before we process it.
• Each company's data is isolated at the database level with row-level security, and team roles limit who sees what.
• Least-privilege access for our own team, and regular backups.

No system is perfectly secure. If a breach affects your data, we'll tell you without undue delay and explain what we're doing about it, as the law requires.

Depending on where you live, data protection laws (in Egypt, the Gulf countries and elsewhere) may give you the right to:

• Know what data we hold about you and get a copy.
• Correct inaccurate data.
• Ask us to delete your data.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw consent you gave earlier.
• Complain to your data protection authority.

To use any of these rights, email nazmy@propdrop.online. We may need to confirm your identity first, and we'll reply within 30 days.

If you messaged a real-estate company that uses PropDrop, that company decides how your data is used. Please send any request about your data to the company first.

If you can't reach the company, write to nazmy@propdrop.online and tell us which company you contacted. We'll pass your request on and help them respond.

• Essential cookies keep you signed in and secure your session.
• Preference cookies remember your language.
• Local storage in the chat widget remembers the visitor's open conversation on that device, so it continues after a page refresh.
• Service worker: the installable app caches app files on your device so it loads faster and, if you allow it, shows notifications.

• No advertising cookies
• No cross-site tracking pixels
• No selling of browsing data

The Service is for businesses and isn't meant for anyone under 18. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we'll delete it.

When you connect WhatsApp, Messenger, Instagram or Telegram, Meta or Telegram also process those messages under their own terms and privacy policies. Links to other websites are governed by their own policies. Our Messaging policy explains how the Meta channels work with PropDrop.

We may update this policy as the Service or the law changes. We'll change the "last updated" date above, and for important changes we'll tell account owners by email or in the dashboard before they take effect.

Privacy questions and requests: nazmy@propdrop.online. Anything else: nazmy@propdrop.online.